4 ms·
What's the business case for PayPal not using 2FA? I've never done an integration with them but I wonder if there are SLAs in place that require a maximum amou
by Yhippa 11y ago
What's the business case for PayPal not using 2FA? I've never done an integration with them but I wonder if there are SLAs in place that require a maximum amount of steps or an average transaction time or something that verifying via SMS or a physical token would invalidate. Seems to me that PayPal accounts would be a major honeypot for seedy activity and that the customer service impact of dealing with this is high.
Unless this is a very rare thing at PayPal and internally they know it.
- tedmiston 11y agoThey do offer 2FA, but calling customer service circumvents it. I wish he had been a little more explicit here, but I think Krebs' point was to raise the question: Why doesn't customer service use (dynamic) 2FA?
- KirinDave 11y agoAnd the answer is all-too-often: "We didn't build or train our call center, nor is it actually part of a single central system. We get contracts and then their support staff plugs into our backend and we hope the security constraints written on the contract are real and the training is adhered to." I'm in the middle of requirement gathering for an unheard-of project: a custom, in-house support console for a new product I'm working on. We're even going to source someone to make training and testing materials, and do auditing independently of the call center (along with their auditing). Sad part is, while I find it a bit intimidating because I've never undertaken a project like this before, it's not proven very difficult. It's just the miserable state of most enterprise IT and how very bolted-on customer support is to most operations.